---
typeId: req
recordId: benac-host-002
fields:
  title: Package host interface mediation
  statement: >-
    Package operations shall interact with the host through mediated imports or
    equivalent mediated calls only.

    Required package-host behavior shall include validated request retrieval, validated
    descriptor config retrieval, evidence emission, effect request, output return, log
    event, blob read for authorized exact blob CIDs, blob write through capability
    grant, HTTPS fetch through capability grant, secret or credential use through
    capability grant, authenticated external-service operation through capability grant,
    encryption/decryption requests through capability grant, storage operation requests
    through storage lease, compute operation requests through compute lease, mediated
    package invocation requests through the Host Station invocation path where
    authorized, clock where granted, random bytes where granted, authentication-context
    introspection where allowed, and capability introspection.

    Package-visible request and descriptor config data shall come only from validated
    invocation input envelopes, validated descriptor snapshots, package-declared
    inputs, or mediated responses authorized for the relevant operation phase.

    Packages shall not receive raw private keys, raw authentication credentials,
    unrestricted signing authority, unrestricted decryption authority, direct document-
    store access, host-local defaults, UI state, operational document metadata, debug
    fields, local indexes, sync state, local availability state, local verification
    state, or unvalidated convenience projections.
  rationale: >-
    Package execution must be mediated by Local Policy and capability grants rather than
    ambient authority. A package can use any input it observes, so package-visible input
    must be deliberately bounded.
  verification: >-
    Package-host conformance tests prove authorized mediated calls succeed through
    scoped grants and forbidden direct access to keys, credentials, signing, decryption,
    document-store APIs, host metadata, UI state, debug fields, and unvalidated
    projections fails closed or omits the data.
  area: BENAC-HOST
  sourceSections:
    - Package host interface
  order: 192.1
  testable: true
  status: draft
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
---
